General

  • Target

    df9ae1ee4f2b0aa1f7a2e70779f9dbd4.bat

  • Size

    222B

  • Sample

    200815-vt34hr5826

  • MD5

    19b3b3791a8bb6e48fca9c29132a649e

  • SHA1

    b03af91b377f63ab4d6c236a7f942643aa66498f

  • SHA256

    4167595a02a41357a7cb611b831f74f802ce747c124913fefe76789babbf1c40

  • SHA512

    f2e3d44f22f21c2a5d24013772ec273c510fc76ab32e6586125c22d968886198d2225138570153385fb94b06f0360e13a59fd7fe33fef2aa3c447e25554eac42

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/df9ae1ee4f2b0aa1f7a2e70779f9dbd4

Extracted

Path

C:\550tx9u8m-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 550tx9u8m. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C674556755EA6F06 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C674556755EA6F06 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 8i8ZccpRf/lmlSxpUlZDZ0cMgR20ejd1ZnlGGYVIDLTUH4PDIvD+O8bcLLAR6cKD 28j95QR/27qlOgTZyrT+IrSv5V72UWX+sdUaskNwsbcKBUS35EMfjVOgxt4WBOfA 1B0ZTeLi+X4wxMwzIqSbAMRk6vPLu4NGkeE3LOQLQx/zGwaHpp4ICIEyur8aLgom CDrgTWZwJy35WBw5m+coQUw5+ckSof/5JoYl3ZYUuzliZgu32WHweZr+vLaFHsD4 v/dkLDglHeHavVEsZDTriMqeB7pdLZGUpnaC7nngeW38ZJtLIBIrxqPYqi90eIjq xXxOM7eQB+LN3DxMZD5zVTnlg3FFw2Cb7OGaYAwf+pN2U48+HpIbUshfHg8UtFPD w52nbvCgUqu0CGmeeiNrW5704pG/r3RPhZ+7o+Bwu/tK3iMfaowLjGQvGhIPt1d7 jo32DrK+q80W9psOlMI+6VYmyLvFmjTH09sg0euxd58xcnKHy+HMkchOWfFPj53c xZrmC0rHn+/h++yR97ZmYVrLjSr69TmM1EG2P8UJDa1z00XQagjng0QBBW/tYHjF NtYD3iZ6CayvQ4WHGG21nm8kUZUhpaHINgfXlzR3y4BBkpb6A/e4GCjj96M/GGG5 pMY8MKpsTlWO6F+un+Pi0OyLqkZ6HycFPBn0srQWT5hLdcx3wJTCMO9omOsV3MeB 5s+WcNEbcU/zwV8HCSIDGn8P6jM4u/OVsXYftRJdgZhYoOkcuYRYPd6DKmPtpysC blmzTHaKsB3Mf9MpRTCpc+rTHocsBbrtXv+S6MtA/AnaJwlx2svVjz6GPGLxvpGc 7TPTDbYoe3jRUy6RQGmoJn8xzfqZXWzUlmva9+iqCPllrb9vLX9F4qeaRzHZ17Ao 4CCjWfFNbEhtuSYUoCnI37DUl0JYw1ckx7qun7dESYk36OwsmmudwhYHyvjHTGC6 CrDhs5hGXSDJgN98viqwsQFmEH5FQdq/Ps3rGdFdSDcQkWDlFORm5jEq+8n9BSjd qaHGnJXXcbFbL9UgWLrCBp6I+c4J0f4vZZZbv3WrIBmZAA3uLU2iYDZDRNawGCAw maDd+pNcvOZS93m0nuWvPwB9c0wtMNQE+bU4p6kJrVY7AqW2izZgvDKSox/NZDpO KjOilcOOgcEW4PD7HicFVIFthmYwQeOb5nbZ4rVxxG8hp4vYv9W1lj9d4WQSiQsN RS7U68UDQyGoOAJOLmPjH/zY5QGtGVF4kXGmrBjIRh0q38Ns4B8oPwG9VzQKoAY+ bvZrSJU+m2OjEMtsp6EvnnFsj5dzp58wqiXpQoD1u91XXOIwHrQ= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C674556755EA6F06

http://decryptor.cc/C674556755EA6F06

Extracted

Path

C:\z795dq-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension z795dq. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3FB5F5D0526F17E3 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/3FB5F5D0526F17E3 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: WIHeQxC39lCrYt3S+00z6uk6ZYR7Hnd4lDx5AQpdOr9wFMDT8EZWIlKmCojwtoll ot2QhQ8uhFVfvvLINcOjuEv44DBHKcByTfoKx2/AorloJtjvilk43dj4HjeLZIwO VBYcog9ad08De4gNX8rwUIH6j+Lh+3PLmmkSOQiiTm8OyGHsERF7Fg02MPR9LuX2 RkCeYrLd+8Cx6vh+EFxQn/KFHpR9XBbXVjzuH1ifBIphOFydO2mwBVRS+ezwrLB1 sxt+5omlqdYcEuciV2NhROQbzlrH9Oblp5gf5VFn/tn9RKpiIwIJ86LWyAYGn4nj 8pa5tfJsNwb7BN1GRUJ4kH/4zm0IC2OIjAfhH3DsXYSZWk0lvOqnZ8xLkfYk9wYH CTUxVeQ1/efaxy7WbD+GADh8ggRUJR4cc3d6sLVDnXVYrZQoqOub+NBN9M11lHvb +jZcVpNYgAkogx3FYTCQHTjt1LGIEiJ5ISKwLqqslEIox1U7/8TtmJ7sqXqd9gJC SwQ7oUYgZUGrHIeShjvC9cHsbA8KXFoYcPvoVV+n9nVXUdORsX0/4YhGnObmGvI2 civNmLm5K/iLLJ1h/x0myIY/CPSuAohQLtX/6ihOpyRW6On5iNC7JFgwHQtyCwNa Kz4jy9zOW8wlj0Kw9inM9nuC0KMg3g1mmMQ2tCJ97Au1IydQpXhwTcI+68huzRn7 9W8MVx7gdGeNV8AlIdy639v4jPLk6uHyL4Ul3JyoQNZO9k5kLa1GvojkVuCV4tbu 1FgpfuG/szwWXUaU8aRvxPKrlNXCPwDuYZQ8J0nwdvdQjvicqVoOTc/fd6v25Ggl 4HGXokeMWq2WkeO//f/f7UpSPzB0NK7xymE4CzezOi8CAQnMw5ABL5A/6IyangJd fXS8I/5FXc06pLyNN2FjFD5n/MIW++DfQbOWO4uTDjXww02NolHwAW1TxfAut/7/ BSLl5mgpjA1HRXrDdr+4xrQVUxAR/42W77KI+t0s0ReZc7khVLqCy5BdKpFffSk3 EPyeNaduTiieNBEjTkMpa+ETzpMbVGmBz/NvFdchmbZ/Powx/D35BiLjwFehr1Co QmCT5044QVSUE3X/Jj5isCMoHO7sEnlUzoC+rVyee0YNirNoXH58UMa3fNq0QOXM TKEwaVDppg3RZr5tj2LIzjgVT9ne8+czGFKt5oJ+izmzSfzy62wuqGDK9E2iMX3P KOevByN5ykYsdmL9acXj/Yc6NNOxrkxAmY1jXTjGIIhPwj/BF3LmM/rBf2BjFZkg 60fqc7rjui4COekWuZmCIg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3FB5F5D0526F17E3

http://decryptor.cc/3FB5F5D0526F17E3

Targets

    • Target

      df9ae1ee4f2b0aa1f7a2e70779f9dbd4.bat

    • Size

      222B

    • MD5

      19b3b3791a8bb6e48fca9c29132a649e

    • SHA1

      b03af91b377f63ab4d6c236a7f942643aa66498f

    • SHA256

      4167595a02a41357a7cb611b831f74f802ce747c124913fefe76789babbf1c40

    • SHA512

      f2e3d44f22f21c2a5d24013772ec273c510fc76ab32e6586125c22d968886198d2225138570153385fb94b06f0360e13a59fd7fe33fef2aa3c447e25554eac42

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks